rules/findings/m365/sharepoint_online/policies/spo-guest-user-sharing-disabled.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "SharePoint Online", "serviceName": "Microsoft 365", "displayName": "Ensure that SharePoint guest users cannot share items they don\u0027t own", "description": "SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.", "rationale": "Sharing and collaboration are key; however, file, folder, or site collection owners should have the authority over what external users get shared with to prevent unauthorized disclosures of information.", "impact": "The impact associated with this change is highly dependent upon current practices. If users do not regularly share with external parties, then minimal impact is likely. However, if users do regularly share with guests/externally, minimum impacts could occur as those external users will be unable to \u0027re-share\u0027 content.", "remediation": { "text": "###### To set SharePoint sharing settings, use the Microsoft 365 Admin Center\r\n\t\t\t\t\t1. Under `Admin centers` select `SharePoint`.\r\n\t\t\t\t\t2. Expand `Policies` then select `Sharing`.\r\n\t\t\t\t\t3. Expand `More external sharing settings`, uncheck `Allow guests to share items they don\u0027t own`.\r\n\t\t\t\t\t4. Click `Save`\r\n\t\t\t\t\t\r\n\t\t\t\t\t###### To Set Prevent external users from sharing files, folders, and sites that they don’t own, use the SharePoint Online PowerShell Module:\r\n\t\t\t\t\t1. Connect to SharePoint Online service using `Connect-SPOService`.\r\n\t\t\t\t\t2. Run the following SharePoint Online PowerShell command:\r\n\t\t\t\t\t```Powershell\r\n\t\t\t\t\tSet-SPOTenant -PreventExternalUsersFromResharing $True\r\n\t\t\t\t\t```", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://docs.microsoft.com/en-us/sharepoint/external-sharing-overview", "https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "7.2.5", "profile": [ "E3 Level 2", "E5 Level 2" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "o365_spo_tenant_admin_details", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "PreventExternalUsersFromResharing", "eq", "false" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "RootSiteUrl": "Root Site", "AllowEditing": "Allow Editing", "AnyoneLinkTrackUsers": "Link Track Users", "ConditionalAccessPolicy": "Conditional Access Policy", "PreventExternalUsersFromResharing": "Prevent External Users From Resharing" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ "RootSiteUrl" ], "message": "Ensure that SharePoint guest users cannot share items they don\u0027t own for {RootSiteUrl}", "defaultMessage": null }, "properties": { "resourceName": "Url", "resourceId": "_ObjectIdentity_", "resourceType": "SPOTenant" }, "onlyStatus": false } }, "idSuffix": "spo_guest_users_sharing_disabled", "notes": [ ], "categories": [ ], "immutable_properties": [ "_ObjectType_", "_ObjectIdentity_", "Url" ], "id": "microsoft365_2189" } |